SC-100 Practice Test 2 — 25 Questions

Question 1

A company has a hybrid identity infrastructure with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. The security team wants to use Microsoft Defender for Identity (MDI) to detect on-premises attacks. They have installed the MDI sensor on all domain controllers. However, they notice that some alerts are missing. What is the most likely cause?

Accepted Answer

The necessary Windows event logs are not being forwarded to the MDI sensor.. Microsoft Defender for Identity relies on Windows Event Logs (specifically Event ID 4776, 4624, 4648, and others) to detect on-premises attacks such as Pass-the-Hash, Golden Ticket, and DCSync. If these logs are not being forwarded to the MDI sensor (e.g., due to disabled audit policies or log size limits), the sensor cannot analyze the events, resulting in missing alerts. The sensor itself is installed on domain controllers, but it must have access to the relevant security logs to function correctly.

Answer

MDI is not integrated with Microsoft Sentinel.

Answer

Azure AD Connect is not syncing frequently enough.

Answer

The sensor is not licensed for all detection types.

Question 2

A company uses Azure Front Door to load balance traffic across two origin servers in different Azure regions. They notice that failover is not working when one origin becomes unhealthy. What is the most likely cause?

Accepted Answer

The health probe path is set to an incorrect endpoint on the origin servers.. The most likely cause is that the health probe path is set to an incorrect endpoint on the origin servers. Azure Front Door uses health probes to determine the health of each origin; if the probe path does not return a 200 OK status (e.g., it points to a missing page or a resource that doesn't exist), Front Door will mark that origin as unhealthy and stop routing traffic to it. Since failover is not occurring, the healthy origin is not being detected as healthy, or the unhealthy origin is not being detected as unhealthy, which directly prevents proper failover.

Answer

Both origins are in the same region.

Answer

Caching is enabled on the Front Door profile.

Answer

Session affinity is enabled.

Question 3

Which TWO of the following are valid methods to secure Azure Kubernetes Service (AKS) workloads?

Accepted Answer

Integrate Azure AD for cluster authentication. Option A is correct because integrating Azure AD with AKS enables authentication and authorization for cluster access. Option E is correct because Azure Policy with Gatekeeper (Azure Policy for AKS) allows enforcing security policies on AKS workloads, such as pod security constraints. Option B is wrong because Network Security Groups apply to subnets and VMs, not directly to pod subnets; pod-level security is managed via Kubernetes Network Policies. Option C is wrong because Azure Firewall is a network-level firewall for perimeter security, not specifically for securing AKS workloads. Option D is wrong because Azure Front Door is a global load balancer and application delivery service, not designed for workload-level security.

Answer

Apply Network Security Groups to pod subnets

Answer

Deploy Azure Firewall in front of the AKS cluster

Answer

Use Azure Front Door to protect API endpoints

Question 4

A company uses Azure Firewall to inspect outbound traffic from a hub virtual network. They need to ensure that traffic from a spoke virtual network to a specific SaaS application (api.contoso.com) bypasses the firewall for performance reasons. What is the most efficient way to achieve this?

Accepted Answer

Add a user-defined route (UDR) in the spoke virtual network's route table with destination api.contoso.com and next hop type 'Internet'.. Option B is correct because adding a user-defined route (UDR) with destination api.contoso.com and next hop type 'Internet' in the spoke virtual network's route table forces traffic destined for that FQDN to bypass the Azure Firewall and go directly to the internet. This is the most efficient approach as it avoids firewall inspection for performance-sensitive traffic without requiring any firewall rule changes.

Answer

Configure an application rule in Azure Firewall with a 'Bypass' action for api.contoso.com.

Answer

Enable service endpoints for Microsoft.Storage in the spoke subnet.

Answer

Create a network rule in Azure Firewall to allow traffic to api.contoso.com and deny all other traffic.

Question 5

A company deploys Azure Bastion in a VNet. They want to allow a security engineer to connect to a Windows VM in a peered VNet using Azure Bastion. The engineer can see the VM in the portal but cannot connect. Which configuration is most likely missing?

Accepted Answer

The peered VNet does not have 'Allow Azure Bastion Communication' enabled on the peering connection.. Azure Bastion requires the 'Allow Azure Bastion Communication' setting to be enabled on the peering connection for the peered VNet. Without this, the Bastion service cannot route traffic to the target VM in the peered VNet, even though the VM is visible in the portal. This setting allows the Bastion's control plane and data plane to communicate across the peering link.

Answer

The Azure Bastion subnet size is /28.

Answer

The VM's subnet does not have an inbound NSG rule allowing RDP (3389) from the Azure Bastion subnet.

Answer

The VM does not have Azure AD authentication enabled.

Question 6

Order the steps to deploy Azure Firewall with forced tunneling in a hub virtual network.

Accepted Answer

Step 1: Deploy Azure Firewall. Step 2: Create a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP. Step 3: Associate the route table to the subnet. Step 4: Configure firewall rules.. Forced tunneling requires a route table directing traffic, then firewall deployment and rule configuration.

Answer

Step 1: Create a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP. Step 2: Deploy Azure Firewall. Step 3: Associate the route table to the subnet. Step 4: Configure firewall rules.

Answer

Step 1: Deploy Azure Firewall. Step 2: Associate the route table to the subnet. Step 3: Create a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP. Step 4: Configure firewall rules.

Answer

Step 1: Associate the route table to the subnet. Step 2: Deploy Azure Firewall. Step 3: Create a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP. Step 4: Configure firewall rules.

Question 7

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster?

Accepted Answer

Enable Azure AD integration for Kubernetes RBAC.. Option A is correct because integrating Azure AD with AKS enables Kubernetes RBAC to use Azure AD identities for authentication and authorization. This allows you to grant granular permissions to users, groups, or service principals based on their Azure AD roles, eliminating the need for static Kubernetes secrets and providing centralized identity management.

Answer

Disable HTTP application routing.

Answer

Enable Azure Firewall to restrict outbound traffic.

Answer

Use a service principal for AKS cluster authentication and store the secret in a Kubernetes secret.

Question 8

Order the steps to configure Azure DDoS Protection Standard for a virtual network.

Accepted Answer

Create a DDoS Protection plan, then associate the plan with the virtual network, then enable DDoS Protection on the virtual network, then configure diagnostic settings for monitoring and alerts.. DDoS Protection requires a plan, association, enablement, then monitoring setup.

Answer

Associate the plan with the virtual network, then create the DDoS Protection plan, then enable DDoS Protection on the virtual network, then configure diagnostic settings.

Answer

Create a DDoS Protection plan, then enable DDoS Protection on the virtual network, then associate the plan with the virtual network, then configure diagnostic settings.

Answer

Enable DDoS Protection on the virtual network, then create a DDoS Protection plan, then associate the plan with the virtual network, then configure diagnostic settings.

Question 9

Order the steps to implement Azure AD Privileged Identity Management (PIM) for a role.

Accepted Answer

Step 1: Select the role in Azure AD PIM. Step 2: Configure role settings (e.g., activation duration, approvers). Step 3: Assign eligible members to the role. Step 4: Activate the role assignment when needed.. PIM setup involves selecting role, assigning with eligibility, and activation process.

Answer

Step 1: Assign eligible members to the role. Step 2: Select the role in Azure AD PIM. Step 3: Configure role settings. Step 4: Activate the role assignment.

Answer

Step 1: Configure role settings. Step 2: Activate the role assignment. Step 3: Select the role. Step 4: Assign eligible members.

Answer

Step 1: Activate the role assignment. Step 2: Select the role. Step 3: Assign eligible members. Step 4: Configure role settings.

Question 10

A company is designing a data protection strategy for Azure SQL Database. They need to ensure that backups are retained for 7 years to meet regulatory compliance. Which Azure feature should they use?

Accepted Answer

Long-Term Retention (LTR). Long-Term Retention (LTR) for Azure SQL Database allows you to retain full database backups for up to 10 years, which meets the 7-year regulatory compliance requirement. LTR is specifically designed for archival and compliance scenarios, storing backups in separate containers with configurable retention policies based on weekly, monthly, or yearly intervals.

Answer

Geo-redundant backup storage

Answer

Point-in-Time Restore

Answer

Active Geo-Replication

Question 11

A company is designing a secure hybrid network architecture. They have an on-premises network connected to Azure via ExpressRoute and a site-to-site VPN as backup. They want to ensure that traffic from Azure to on-premises always uses ExpressRoute when available, but automatically fails over to VPN if ExpressRoute goes down. Which configuration should they implement?

Accepted Answer

Configure BGP on both connections and assign a higher local preference (e.g., 200) to routes learned via ExpressRoute.. Option D is correct because BGP local preference is an attribute used to influence outbound traffic from an AS. By assigning a higher local preference (e.g., 200) to routes learned via ExpressRoute, Azure will prefer those routes over VPN routes (which default to local preference 100). This ensures that traffic from Azure to on-premises uses ExpressRoute when available, and automatically fails over to the VPN if the ExpressRoute BGP session drops, as the VPN routes will then be selected.

Answer

Configure the VPN to have a lower BGP weight than ExpressRoute.

Answer

Use both connections in active-active mode with BGP and rely on ECMP.

Answer

Disable BGP on the VPN connection and use static routes with a higher metric for the VPN.

Question 12

A company deploys a three-tier application with web servers, application servers, and database servers in a VNet. They need to ensure that web servers can only communicate with application servers on port 443, and application servers can only communicate with database servers on port 1433. Web servers should not be able to communicate with database servers. What is the most secure and efficient way to implement this?

Accepted Answer

Place each tier in a separate subnet, and create NSGs on each subnet with appropriate inbound and outbound rules.. Option A is correct because placing each tier in a separate subnet and applying Network Security Groups (NSGs) with specific inbound and outbound rules provides network segmentation and granular traffic control. NSGs are stateful, so you can define rules that allow web servers to initiate outbound traffic to application servers on port 443 and application servers to initiate outbound traffic to database servers on port 1433, while implicitly denying all other cross-tier communication (including web-to-database). This approach is both secure and efficient as it uses native Azure constructs without additional cost or complexity.

Answer

Use Azure Firewall to inspect all traffic between tiers.

Answer

Use Application Security Groups (ASGs) to group VMs, but do not create NSGs.

Answer

Place all tiers in the same subnet, and use a single NSG with rules to allow and deny traffic.

Question 13

A company uses Azure Policy to enforce that all storage accounts must have HTTPS traffic only. They assign a built-in policy to audit this setting. A developer creates a new storage account with HTTP enabled, and the policy reports it as non-compliant. What should the company do to automatically remediate this violation?

Accepted Answer

Create a new policy assignment with a 'deployIfNotExists' effect that enables HTTPS-only.. Option D is correct because the 'deployIfNotExists' effect in Azure Policy can automatically remediate non-compliant resources by deploying a configuration (such as enabling HTTPS-only) when the policy detects a violation. This effect runs a remediation task that modifies the resource to meet the policy requirement, eliminating the need for manual intervention. In this scenario, it would automatically enable HTTPS traffic on the storage account, bringing it into compliance.

Answer

Enable Azure Security Center's just-in-time access for storage accounts.

Answer

Change the policy effect to 'Deny' to prevent creation of non-compliant storage accounts.

Answer

Ask the developer to manually enable HTTPS-only on the storage account.

Question 14

A company deploys Azure App Service with a custom domain and SSL certificate. They want to enforce HTTPS only. Which configuration setting should they enable?

Accepted Answer

HTTPS Only. The 'HTTPS Only' setting in Azure App Service enforces that all incoming requests are redirected from HTTP to HTTPS, ensuring encrypted communication. This is achieved by returning a 301 redirect for any HTTP request, which aligns with the requirement to enforce HTTPS only.

Answer

Client Certificates

Answer

Minimum TLS Version

Answer

Custom Domain

Question 15

You are designing an API management solution using Azure API Management. Which TWO should you implement to protect the API from unauthorized access? (Choose TWO.)

Accepted Answer

Implement OAuth 2.0 authorization with Microsoft Entra ID.. The correct answers are A and E. OAuth 2.0 with Microsoft Entra ID (A) provides delegated authorization, allowing API Management to validate tokens and restrict access based on permissions. Subscription keys (E) offer a simple authentication mechanism by requiring a unique key in each API call. Option B (client certificates) is for mutual TLS authentication, which is not a primary method for typical API access. Option C (CORS) controls cross-origin requests but does not authenticate callers. Option D (IP address restriction) limits access by network location but is not an authentication method.

Answer

Use client certificates for authentication.

Answer

Enable Cross-Origin Resource Sharing (CORS).

Answer

Restrict access by IP address only.

Question 16

Your organization is designing a new application that will store sensitive customer data in Azure Cosmos DB. You need to ensure that data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. What should you configure?

Accepted Answer

Configure a customer-managed key in Azure Key Vault and assign it to the Cosmos DB account.. Option D is correct because Azure Cosmos DB supports customer-managed keys (CMK) by creating an encryption key in Azure Key Vault and associating it with the Cosmos DB account. Option A is incorrect because Transparent Data Encryption (TDE) is a feature for SQL databases, not for Cosmos DB. Option B is incorrect because Azure Storage Service Encryption (SSE) applies to Azure Blob Storage and other storage services, not Cosmos DB. Option C is incorrect because Always Encrypted is a feature for Azure SQL Database and SQL Server, not for Cosmos DB.

Answer

Enable Transparent Data Encryption (TDE) on the Cosmos DB account.

Answer

Enable Azure Storage Service Encryption (SSE) on the Cosmos DB account.

Answer

Use Always Encrypted with Azure SQL Database.

Question 17

A company uses Azure Storage for sensitive data. They need to ensure that data is encrypted at rest and that encryption keys are managed by the customer (Customer-Managed Keys). Which THREE actions are required?

Accepted Answer

Create an Azure Key Vault to store the customer-managed key. Option B is correct because customer-managed keys (CMK) for Azure Storage encryption must be stored in an Azure Key Vault, which provides a secure, centralized repository for managing cryptographic keys. Without a Key Vault, the customer cannot control or rotate the encryption keys used by Storage Service Encryption (SSE).

Answer

Enable double encryption

Answer

Enable Azure Information Protection

Question 18

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). They need to secure communication between services using mutual TLS (mTLS). Which solution should they implement?

Accepted Answer

Istio service mesh. Istio service mesh is the correct solution because it provides a dedicated infrastructure layer for managing service-to-service communication, including automatic mutual TLS (mTLS) between microservices. Istio injects Envoy sidecar proxies into each pod, which handle encryption, authentication, and authorization without requiring application code changes. This enables zero-trust network security within the AKS cluster.

Answer

Azure Application Gateway

Answer

Azure Firewall

Answer

Azure API Management

Question 19

A company is designing a data classification strategy for their Azure environment. They need to identify sensitive data stored in Azure SQL Database. Which TWO solutions should they consider?

Accepted Answer

Azure SQL Data Discovery & Classification. Azure SQL Data Discovery & Classification is correct because it is a native feature of Azure SQL Database that automatically discovers, classifies, and labels sensitive columns (e.g., credit card numbers, PII) directly within the database engine. It provides a built-in dashboard for auditing and monitoring classification status, making it the primary tool for identifying sensitive data stored in Azure SQL Database.

Answer

Azure Information Protection

Answer

Azure Purview

Answer

Azure Policy

Question 20

A company uses Azure Policy to enforce compliance. They have a custom policy that denies creation of storage accounts without encryption enabled. A developer reports that they cannot create a storage account even though they specified encryption. What is the most likely cause?

Accepted Answer

The policy's 'then' block uses 'deny' but the condition logic evaluates the 'encryption' property incorrectly. Option C is correct because the most likely cause is that the policy's condition logic incorrectly evaluates the 'encryption' property. Azure Policy uses JSON-based condition expressions to check resource properties; if the condition does not match the actual property path (e.g., 'properties.encryption.enabled' vs. 'properties.encryption') or uses an incorrect operator, the deny effect will trigger even when encryption is specified. This is a common misconfiguration in custom policies.

Answer

The developer does not have 'Microsoft.Authorization/policyAssignments/write' permission

Answer

The policy effect is set to 'audit' instead of 'deny'

Answer

The policy is scoped to a management group that includes the developer's subscription